Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranches of data if you are looking at a system shortly after an event. Ask me 6 months later- probably not. Give me a system that hasn't even rebooted, has a heap of ram and hasn't been used much since- 6 weeks is fine, not ideal, but doable.